Privacy Policy
Navaro AI (“Navaro,” “we,” “us”) is the public operator and service name. Navaro helps users save, organize, retrieve, and continue useful work across supported AI platforms and websites. This Policy explains how the current Navaro extension and related cloud features process information. Privacy and data requests may be sent to carbi.office@gmail.com.
Information Navaro processes
Depending on the features you use, Navaro may process submitted prompts, completed AI responses, selected web content, saved emails or messages, images, videos, documents and other attachments; source URLs and titles; provider, platform and model labels when reliably detectable; timestamps, language, Projects, task and workflow identifiers; Save, Inject, retrieval, reuse, edit and workflow-transition events; account identifiers; consent records; settings; and technical information needed to operate, secure and troubleshoot the service.
Workflow and Smart Memory records may also contain conversation and Project pseudonymous identifiers, prompt-response and parent-derived relationships, normalized content hashes used to identify exact duplicates, semantic embeddings, reuse counts, edit status and edit ratios, task categories, comparison-group identifiers, optional ratings or reasons for a user choice, and an identifier for a selected or final artifact where those signals exist. These fields support organization, retrieval, deduplication, workflow reconstruction and user-directed comparison; a content hash is not used as a substitute for semantic similarity.
When you contact support or submit a privacy request, Navaro processes the email address, request type, subject, message, request identifier, submission time, status and resolution time where applicable. Navaro and its infrastructure providers may also automatically process operational records such as IP address, browser or user-agent information, request time, authentication and session events, error details, network and security logs, and similar diagnostics generated when the extension, public website or cloud services are used. The extension does not request Chrome's cookies permission and the reviewed implementation does not include third-party advertising pixels or behavioral advertising analytics; providers may nevertheless use essential cookies or comparable mechanisms on their own authentication or hosted pages under their policies.
Prompts, responses and saved content may contain personal or sensitive information. A pseudonymous identifier can still relate records to the same installation or account and does not make raw content anonymous.
Manual Memory and Save
Manual Save means you intentionally add a supported item to your personal Navaro memory. Navaro stores the selected content and relevant context needed to organize, display, retrieve and inject it. Manual Memory does not automatically capture unsaved AI interactions.
Full Workflow Memory
Full Workflow Memory is optional and starts only after you explicitly enable it. When enabled, Automatic Workflow Capture may store supported prompts after they are submitted, completed AI responses, reliably detectable model information, timestamps, and related workflow transitions even when you do not press Save. Navaro does not intend to capture unfinished composer text. You can turn this setting off in Privacy Policy & Data Settings and continue using Manual Memory.
Smart Memory, Inject and cross-model workflows
Smart Memory may index eligible content and metadata, including semantic embeddings, so relevant memories can be retrieved. Inject places context you select into a supported destination composer. Workflow identifiers and Save or Inject events may link related steps across platforms so Navaro can remember where a task began, where it continued, and which model labels were exposed by the platforms. If an exact model is not reliably available, Navaro may record it as unknown.
Local and cloud processing
Chrome extension storage may contain local memories, Projects, settings, consent state and related extension data. Enabled cloud features use Navaro’s Supabase backend for functions such as authentication, Smart Memory, semantic retrieval, storage of eligible memories or media, workflow records, consent history and related service operation. Not every local action is necessarily copied to the cloud, and not every cloud record is included in a local export.
Eligible images, videos and documents may be uploaded to Supabase Storage so that Navaro can display, retrieve, download or reuse them. The current media bucket may produce a public or link-accessible URL. A person or service that obtains such a URL may be able to access the associated file without opening the Navaro extension. Users should therefore avoid saving media that they do not want stored in this manner, and Navaro should not describe such files as private merely because the URL is difficult to guess.
Third-party AI platforms and websites process information under their own privacy policies and terms. Injecting content into a third-party service sends that content to the selected service as directed by you.
Google and Apple sign-in
Navaro uses Google Sign-In and Sign in with Apple through Supabase authentication to create or link an account. The current extension keeps the provider-linked Navaro account identifier, the email address returned by the provider, and the account name when the provider supplies one. Apple may provide a private relay email instead of your ordinary email, and may provide a name only during the first authorization. OAuth providers may return additional basic profile metadata during authentication, but Navaro does not currently retain a profile image in its active account record. Navaro uses the retained account information only for authentication, account linking, security and supported account synchronization.
Age
Navaro is intended for users aged 18 or older. Do not create or use a Navaro account if you are under 18.
How information is used
Navaro uses covered information to provide saved memory, Projects, search and retrieval, Smart Memory, Inject, workflow continuity, account functionality, security, diagnostics, support, and improvements to those disclosed user-facing features.
Legal bases for processing
Where the law requires a legal basis, Navaro processes account and service information as necessary to provide the service requested by the user and perform its Terms; processes Full Workflow Memory and optional research information on the basis of the user's affirmative choice or consent where consent is required; and processes limited operational, security, fraud-prevention, support and service-reliability information where necessary for Navaro's legitimate interests, provided those interests are not overridden by the user's rights. Navaro may also process or preserve information to comply with a legal obligation, establish or defend legal claims, or protect vital interests where applicable. A user may withdraw a consent-based choice for future processing through the relevant setting or support channel, but withdrawal does not invalidate processing already carried out lawfully and does not automatically require deletion of information retained under another lawful basis.
Optional research and product improvement
Research contribution is separate from Full Workflow Memory and is off unless you explicitly turn it on. When enabled, eligible prompts, outputs, platform/model information and workflow signals may be processed for the disclosed research and product-improvement purpose together with a pseudonymous or account identifier and consent version. Turning Full Workflow Memory on does not turn research consent on. You may withdraw the optional research choice in Settings; withdrawal stops future optional contribution, subject to applicable law.
Service providers and disclosure
Navaro may use service providers for infrastructure, database, authentication, hosting, storage, security and support. Supabase provides cloud database, storage and authentication infrastructure used by current Navaro cloud functionality. Providers receive information only as needed to provide their services or as otherwise permitted by law. Navaro does not sell user data to data brokers, advertisers or information resellers and does not use covered data for personalized advertising.
International processing
Navaro and its service providers may process or store information outside the country where you live. Current providers include Supabase for cloud database, storage, authentication and Edge Functions; Google and Apple when you use their sign-in services; Google Firebase for the authentication callback page; and OpenAI Sites and its hosting infrastructure for the public Navaro website. Their processing locations may vary according to their infrastructure and your use of their services.
Where applicable law requires a mechanism for an international transfer, Navaro will rely on a legally recognized mechanism available for the relevant transfer, which may include an adequacy decision, contractual protections offered by the provider, or another lawful basis permitted by the applicable law. Navaro has not independently verified a single fixed country or one uniform transfer mechanism for every processing operation and does not represent that a particular safeguard applies where it has not been confirmed. Information reasonably available about the applicable provider or transfer may be requested through the privacy contact.
Limited human access
Authorized Navaro administrators can technically access information stored in Navaro’s cloud systems, including user content, through administrative backend tools. Human access should be limited to what is reasonably necessary for support requested by a user, security and abuse investigation, troubleshooting and service reliability, enforcing applicable terms, or complying with legal requirements. Ordinary users are restricted from reading another user’s records by access controls such as row-level security; those controls do not eliminate authorized administrative access.
Google and Chrome Limited Use
Navaro’s use and transfer of information received from Google APIs and Chrome APIs adheres to the applicable Google API Services User Data Policy and Chrome Web Store User Data Policy, including the Limited Use requirements. Navaro limits this information to providing or improving disclosed user-facing functionality, security and permitted service operation.
Retention
Navaro does not currently apply one fixed number of days to every category of information. Saved memories, Projects and settings in Chrome extension storage remain until you delete or clear them, clear extension storage or uninstall the extension, subject to Chrome behavior. Deleting an individual saved memory or clearing saved memories also requests deletion from Smart Memory for the affected memory, but it does not automatically erase related workflow, telemetry, consent or support records from Navaro's cloud systems.
Cloud workflow tasks, events, captured prompts and responses, Smart Memory indexes and events, and related cloud media currently remain without automatic time-based deletion so that Navaro can preserve workflow continuity, provenance, deduplication and audit history. Account and authentication records remain while the account exists and may be retained afterward where necessary to complete a verified request, maintain security, resolve a dispute, enforce applicable terms or comply with law. Consent history may be retained after withdrawal to document the grant and withdrawal. Support requests may remain while open and afterward as reasonably necessary to document the response, prevent abuse, handle disputes or comply with legal obligations. Infrastructure backups and provider logs may persist for the provider's operational backup, security and disaster-recovery cycles.
These criteria do not authorize indefinite retention when information is no longer reasonably necessary and no lawful basis remains. Where applicable law requires deletion, Navaro will evaluate and act on a verified request subject to lawful exceptions. Workflow history is not silently or automatically purged; any deletion affecting it requires a supported, verified process whose actual scope is communicated to the requester.
Security and incidents
Navaro uses safeguards that are implemented in the current service, including HTTPS network transport, OAuth with PKCE, access controls and row-level security where configured, and separation of server-side secrets from the extension. Navaro does not promise perfect security, comprehensive breach monitoring or encryption at rest that has not been independently verified. If Navaro becomes aware of a qualifying data-security incident, Navaro may investigate, contain and remediate it and will notify affected users or competent authorities when required by applicable law.
Your controls and requests
- Enable or disable Full Workflow Memory and Automatic Workflow Capture.
- Use Manual Memory and choose what to Save.
- Enable or withdraw optional research contribution separately.
- Export supported local Navaro data from Settings.
- Clear saved memories without affecting unrelated account records.
- Request access, correction, deletion, portability, restriction or objection where applicable.
Product deletion controls apply only to the data they expressly identify and do not delete content from third-party AI platforms or websites. The current Delete Account function removes the Supabase authentication user and the corresponding Navaro account record and returns the extension to sign-in. It does not, by that action alone, delete every pseudonymous workflow task, content item, event, Smart Memory record, cloud-media object, consent-history entry or support request that may be associated with the former account or installation. A request to delete those records must be submitted separately through the verified privacy-request process and remains subject to applicable law, technical scope and lawful retention exceptions.
You may use Settings → Support & Contact or email carbi.office@gmail.com to request access, correction or deletion. For export or portability, use Data Export for the supported local data it includes; contact support for other applicable portability requests. Use the Research Contribution toggle to withdraw optional research consent. For restriction or objection requests where applicable, choose Other in the support form or email us. Navaro may need to verify the requester before acting.
Regional privacy rights
EEA and UK. Where applicable, you may request access, correction, deletion, restriction, objection and portability, and may withdraw consent without affecting processing already carried out lawfully. You may also complain to the competent data-protection supervisory authority in your place of residence, work or alleged infringement. Navaro has not appointed or identified a regional representative or data-protection officer in this Policy.
California and other applicable United States laws. Where applicable, you may request to know or access, correct or delete covered personal information, and exercise applicable rights to limit certain uses or opt out of a sale or sharing. Navaro does not sell personal information or share it for cross-context behavioral advertising. Navaro will not unlawfully discriminate against you for exercising an applicable privacy right.
Israel. Where applicable, you may request to inspect personal information about you and ask that inaccurate, incomplete, unclear or outdated information be corrected or deleted. You may contact Navaro and may complain to the competent privacy authority. Rights and exceptions depend on the law that applies to the request.
To exercise an applicable regional right, use Settings → Support & Contact or email carbi.office@gmail.com. If the product does not provide a direct control for a right, Navaro will review the verified request through the support process.
Business transfers
If Navaro is involved in a merger, acquisition, financing, restructuring or sale of assets, relevant information may transfer as part of that transaction, subject to applicable law, appropriate safeguards, notices and any consent required by law. This does not permit an unrestricted sale of user data.
Policy changes
Navaro may update this Policy as the product evolves. The effective date and version will be updated, and material changes will be communicated or presented for renewed consent where required.
Contact
Operator/service name: Navaro AI
Privacy, support and data requests: carbi.office@gmail.com